Weseek GROWI 跨站脚本漏洞

GROWI is a team collaboration software. A stored cross-site scripting vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited by a remote attacker to execute arbitrary script in a user's browser by sending specially crafted content...

IBM Engineering Test Management Cross-Site Scripting Vulnerability (CNVD-2021-14749)

IBM Engineering Test Management is a collaborative quality management solution that provides end-to-end test planning and test asset management with broad coverage from requirements to defects. A cross-site scripting vulnerability exists in IBM Engineering Test Management. An attacker could explo...

IBM Engineering Workflow Management Cross-Site Scripting Vulnerability (CNVD-2021-14750)

IBM Engineering Workflow Management EWM is a team collaboration tool that integrates a variety of development tasks, including iteration planning, process definition, change management, defect tracking, source code control, build automation, and reporting. A cross-site scripting vulnerability...

GLPI Cross-Site Scripting Vulnerability (CNVD-2021-17778)

GLPI is an open source software for IT equipment management, developed using the PHP language. A cross-site scripting vulnerability exists in GLPI versions prior to 9.5.4 when a logged-in user is updating a work order, and no detailed vulnerability details are available at this time...

Aruba ClearPass Policy Manager Cross-Site Scripting Vulnerability (CNVD-2021-13473)

Aruba ClearPass Policy Manager is a network access control NAC solution. A stored cross-site scripting vulnerability in the ClearPass web administration interface in versions prior to Aruba ClearPass Policy Manager 6.9.5, 6.8.8-HF1, and 6.7.14-HF1 can be exploited by an attacker to execute...

CVE-2021-26678

A remote unauthenticated stored cross-site scripting XSS vulnerability was discovered in Aruba ClearPass Policy Manager versions: Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface of ClearPass could allow an unauthenticated remote attacker to conduct a...

CASAP Automated Enrollment Cross-Site Scripting Vulnerability

CASAP Automated Enrollment is an automated enrollment system organized by CASAP in the United States. The purpose of the project is to provide an automated enrollment system for CASAP to streamline the process for schools and make it more effective, efficient and easily retrievable. A cross-site...

CVE-2021-27368

The Contact page in Monica 2.19.1 allows stored XSS via the First Name field...

Cisco Webex Meetings Cross-Site Scripting Vulnerability (CNVD-2021-13232)

Cisco Webex Meetings provides affordable enterprise virtual meeting solutions. A cross-site scripting vulnerability exists in the web interface of Cisco Webex Meetings. The vulnerability stems from insufficient validation of user-supplied input in the web interface of the affected service. An...

Security Updates for Microsoft Dynamics 365 Business Central (Feb 2021)

The Microsoft Dynamics 365 Business Central install is missing a security update. It is, therefore, affected by a cross site scripting XSS vulnerability due to improper validation of user-supplied input. An authenticated attacker can exploit this, by entering specially crafted URLs in the Links a...

Micro Focus Application Performance Management Cross-Site Scripting Vulnerability

Micro Focus Application Performance Management is an application monitoring and management solution that lets you isolate any problems with all your applications - on-premise, cloud and mobile - in real time. A cross-site scripting vulnerability exists in Micro Focus Application Performance...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2021-05523)

Cisco Firepower Management Center is the nerve center for managing Cisco network security solutions, improving the effectiveness of Cisco network security solutions by providing centralized, integrated, and simplified management. A stored cross-site scripting vulnerability exists in the Web...

Cisco Finesse Cross-Site Scripting Vulnerability (NVD-C-2021-11018)

Cisco Finesse is a set of call center management software from the U.S. company Cisco Cisco. Cisco Finesse suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client data in the WEB application, which can be exploited by an attacker to execute client...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2021-05525)

Cisco Firepower Management Center is the nerve center for managing Cisco network security solutions, improving the effectiveness of Cisco network security solutions by providing centralized, integrated, and simplified management. A stored cross-site scripting vulnerability exists in the Web...

Cisco RV110W/RV130/RV130W/RV215W Cross-Site Scripting Vulnerability

The Cisco RV110W is a Wireless-N VPN firewall, the Cisco RV130 is a multifunction VPN router, the Cisco RV130W is a Wireless-N multifunction VPN router, and the Cisco RV215W is a Wireless-N VPN router. A stored cross-site scripting vulnerability exists in the Web management interface of the Cisco...

Cisco RV110W/RV130/RV130W/RV215W Cross-Site Scripting Vulnerability (CNVD-2021-41156)

The Cisco RV110W is a Wireless-N VPN firewall, the Cisco RV130 is a multifunction VPN router, the Cisco RV130W is a Wireless-N multifunction VPN router, and the Cisco RV215W is a Wireless-N VPN router. A stored cross-site scripting vulnerability exists in the Web management interface of the Cisco...

Stored XSS vulnerability on new item page

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to specify display names or IDs of item types. NOTE: As of the publicati...

CVE-2020-26768

Formstone =1.4.16 is vulnerable to a Reflected Cross-Site Scripting XSS vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in...

CVE-2020-28365

Sentrifugo 3.2 allows Stored Cross-Site Scripting XSS vulnerability by inserting a payload within the X-Forwarded-For HTTP header during the login process. When an administrator looks at logs, the payload is executed. NOTE: This vulnerability only affects products that are no longer supported by...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability

Ignite Realtime Openfire is a cross-platform open source Real-Time Collaboration RTC server developed by the Ignite Realtime community in Java and based on XMPP formerly known as Jabber, Instant Messaging Protocol, which is capable of building efficient instant messaging servers and supporting te...